Slashdot videos: Now with more Slashdot!

View

Discuss

Share

We've improved Slashdot's video section; now you can view our video interviews, product close-ups and site visits with all the usual Slashdot options to comment, share, etc. No more walled garden! It's a work in progress -- we hope you'll check it out (Learn more about the recent updates).

Animats writes "SourceForge, a hosting site for many open source projects, is down today. Management claims they were attacked: 'We detected a direct targeted attack that resulted in an exploit of several SourceForge.net servers, and have proactively shut down a handful of developer centric services to safeguard data and protect the majority of our services.' Currently, CVS and SVN access to source code, even for reading, is unavailable, and there is no announced restoration time." (SourceForge and Slashdot are both part of Geeknet, Inc.) Update: 01/27 22:17 GMT by T: Mark Ramm of SourceForge contributes an update and some clarification: the site is up, and SVN is available, though CVS isn't. There's also a follow-up post on the site's blog.

It's simple for the devs, now alerted to a potential compromise, to just branch the repo and do a quick diff between the last known good revision and the one on the server. I doubt a big public attack is going to compromise many projects and those it does manage to compromise are probably mismanaged anyway.

Um...each developer will have a working copy on their local machine. This is most likely to be the last known good version. A quick diff will show up the changes that they've recently made and they can verify that the differences are valid. It's really not that complicated.

If someone wants to go through the trouble of hacking the version control to the point it can propagate to the developers machine, stop them from reverting changes that may have been pulled down just before the repositories were locked do

I have a sourceforge project. All I did was pull down the repo to another location and run a diff on my working repo and the one I pulled down. There were no unexpected differences. I'm struggling to see why this is so hard to understand. It's simple to figure out if your project has changed in an unexpected way. It also easy to overwrite the repository on the sourceforge server with a clean one if you are suspicious.

Seriously, an attack this public will not catch out many projects. And I fail to see how so

LOIC was hosted on SourceForge. Five people were arrested in the UK today for (from the looks of it) using it. I'm not inferring anything, if I did it would be conspiracy theory...I'm just curious as to whether the events are unrelated?

So if Microsoft and Oracle got attacked we would all be laughing at them and making fun of their poor security. But if SourceForge got attack it is nothing but sympathy. Umm I want to know as an OpenSource Software user... How they were able to break in where was the hole. Should we be worried about our software as well.

Heck with checksums. PGP/gpg signed manifest files with SHA-512 hashes for every file stored, from source code tarballs to documentation, and the PGP/gpg keys signed by multiple trustworthy keys in a WOT. This way, dropping in a fake key on a keyserver, then some signed binaries would be found out almost immediately.

For RPMs, if they are not gpg signed by someone, there is a security lapse. Same with Windows.MSI files which don't have Authenticode signatures (although the Windows certificate for a priva

wouldn't be an issue if they were using git. Every commit, every object is stored by SHA-1 hash. Additionally, developers have their own copy of the entire project and can verify that there were no other changes.

That was my thought. Everyone talks about how OSS is so secure. If you had a bone to pick with that notion, why not go over one of the highest profile examples of OSS? I'm sure that they're running Apache, right? Probably MySQL too? Surely they aren't hosting their sight on IIS and powering it with Asp.Net, are they?

It would be great if situations like this brought the entire computer using community closer together. The reality is that no matter how epicly great your software might be, there are people out there looking to bring it down. It doesn't matter if you run Microsoft, Apple or OSS. There are bugs in your applications and there are incentives for finding and exploiting those bugs.

I think for some projects, Linus' Law does apply -at least, it makes sense- but it obviously doesn't mean any OSS code is perfectly secure nor even that the average OSS project is more secure than proprietary code.

But I don't see how a single attack on SF proves anything; you'd have to make a study across a statistically valid sample of projects to determine if, eliminated all other variables, OSS code has or nor a better track record.

Software project A could have more vulnerabilities than project B. If attackers are more interested in B for some reason, maybe it's more popular or the sites running it are more interesting, B could have more "discovered" vulnerabilities.

A correct study would have to pay someone to do a thorough security audit of source code for n major open source and closed source software projects, which would be extremely expensive, and getting t

It isn't hyperbole when it is trotted out time and time again as one of the benefits of OSS. Stability and Security are two of the corner stones that OSS advocates build their arguments against "closed source" on top of. Some of the others are cost and portability of data.

To say that "nobody" has claimed that Apache is best ever is just as extreme of a statement as the original one I made about "everybody" talking about how secure OSS is.

Hyperbole much? Who is this *everyone*? I have not seen any claims of "so secure"

Either you're very new here, or else you have somehow managed to avoid all the articles that ever mentioned Microsoft, Apple, Oracle or any other provider of proprietary software, which is generally on slashdot sneered at for providing poor security on principle.

Possibly a misdirection and general smoke and mirrors technique but I doubt it... Could be that they hit the wrong IP... network order error and it was 60.181.34.216 that is inside China that was the true target and not sourceforge.

Now with that IP one could glean some more info WHY an attack was necessary.... and so on.

I guess this could have been an attempt to spread some malware or something (by poisoning popular projects)?

Off topic: how many people actually download directly from sourceforge any more. I have to imagine the majority of users (even before the mass ubuntu influx) get their stuff second hand through their favorite distro’s repository these days. I know I haven’t been there with any regularity since my `ol slackware days *tugs pants up past waist*.

If you're using OSS software on Windows, SourceForge is the place to go. This fact lends support to my hypothesis that the attack was cover for injecting malware into open-source projects. Windows is malware's biggest target, and users are beginning to gravitate towards using open source tools over piracy (mainly due to fears of malware, ironically enough). With that in mind, I guess Sourceforge was a pretty big target for crackers.

Have the SF admins been notified of this? And this claim is based on manual binary dissection, not just it tripping AV "behaviour analysis"? And lastly, what are you up to if you're not telling which one?

I was more responding to your off-topic comment as to who works directly with sourceforge. That would be everyone who works on open source projects hosted there. I don't think malware is a likely goal.

I build a lot of the libraries I use from source and use a lot of the dev versions, so I end up at sourceforge a decent amount of time. Actually, considering that two of the biggest python libraries are hosted on sourceforge (scipy/numpy) and I really need to update my local versions, this even kind of affects me.

Who ever went there with any regularity? I only go there when I must download something from them. And I have to say that I wish people would stop hosting projects there, because I have more problems with sourceforge failing to deliver me pages than any other major site.

I miss the good old days when hacking was considered a good thing. You know, when it meant doing more with less than the bare minimum or just screwing around with your own hardware to use it in unintended ways without pissing anybody off.

Can really free a portal for open-source software development be such a pebble in a shoe for someone? I can't think of none, *wink wink*, maybe someone who does not like stuff licensed under gpl, *nudge nudge*, oh noes... who can possibly believe in closedsource software as a future for the consumer out there? Oh, i dont know....

You would think that the authors of Ettercap, one of the most popularwhitehat pentesting tools, would know the basics of security.Apparently they don't, or they just don't give a shit about whathappens to their users.

So, why is their website so insecure? Ettercap's message board ishosted at Sourceforge, so they share a server with thousands of othercustomers. Every single customer is able to execute commands andaccess the other project directories. Pretty stupid, eh? You only needto find one hole in one hosted site and you can access ALL the projectdatabases. Of course that isn't ALoR's fault, it's Sourceforge'sfault. Regardless, people who care about security and data integritywouldn't use such a shitty provider, would they?

So, basically, there was no compartmentalization at all (chroot, etc.) between project web pages/data, and as anyone hosted there could upload anything to their web page, it was just a matter of time? How did this not happen earlier, if not through someone just uploading a shell to their own webpage?

Meh they could have done worse...they could have attacked 4chan, Wikileaks, or another site that is likely to get the whole of Anon on their asses. At worse all that would happen to them on Slashdot/Sourceforge would be us finding out a link to a website run by the attackers, posting a link to it on the front page, and letting the/. effect do the rest.

Honestly though I'm fairly certain that 4chan has 'hacked' itself a number if times. Seriously, I'm not sure where they organize their little raids but there's a board (well or some boards) somewhere where IPs are posted for that hideously stupid LOIC program they use for their little DDoS attacks; since most of the people there are presumably completely ignorant script kiddies, it'd be trivial for someone who was bored or had some beef with 4chan to post the IP of 4chan there and the legions of idiots woul

Mod parent up, I should have checked there before starting to ramble. Interesting thing I noticed though: that paper from exploitdb claims that those happy ninjas had access to the ettercap project account for the past 5 years.

This is the ultimate in bullying someone that doesn't deserve it. Kinda like the poor fat kid in middle school that got beat up by the entire football team because they didn't like the way I smelled.

I hope that you vowed to track them all down as adults, and ruin their lives one by one, causing one to go to prison for life for distributing child pornography, another to be executed for high treason by supplying atomic secrets to North Korea, another to be cast into the hellish undersea domain of The Elder Ones and yet another to be sold to Al Qaida as target practice for rabies grenades, until finally, the team captain came to you, begging on his knees, for you just to finish him quickly with a bullet

Perhaps this is a good time to consider upgrading to git, eh? Nothing like a server outage to remind you of the problems associated with a central repository, which you probably haven't even backed up.